Description

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-10T12:17:19.563Z",
  "pubdate": "2026-08-10T12:17:19.563Z",
  "executiveSummary": "A signed integer overflow vulnerability has been identified within the GIMP image manipulation software, specifically residing in the file-fli plugin responsible for processing FLI image files.\nThe core vulnerability stems from an incorrect calculation during memory allocation procedures, wherein the mathematical multiplication of image width and height dimensions exceeds the maximum representable signed integer value.\nSuccessful exploitation of this flaw can be executed by a remote, unauthenticated attacker who successfully engineers a social engineering scenario to trick a target user into opening a specially crafted, malicious FLI image file within the application.\nUpon processing the malformed file, the application triggers a memory corruption or invalid allocation state, leading directly to an application crash and resulting in a localized denial of service.\nThe risk implications are primarily focused on availability, as the execution flow disrupts normal software operations and compromises system reliability during user interaction with untrusted media files.",
  "technicalDetails": "The vulnerability resides in the file-fli plugin of GIMP, which is invoked whenever the application parses, reads, and renders FLI format image files.\nThe root cause of the security defect is a signed integer overflow condition occurring during the dynamic memory allocation phase for image buffers.\nSpecifically, when the plugin calculates the required memory size based on the dimensions of the image, it performs a multiplication operation utilizing the image width and height values.\nDue to a lack of proper input validation and boundary checking on these dimension parameters, unusually large width and height values supplied within the crafted FLI file cause the multiplication result to wrap around the maximum limit of a signed integer data type.\nThis arithmetic overflow results in the allocation of a significantly smaller memory buffer than required to hold the incoming pixel data.\nThe attack flow proceeds as follows: first, the attacker crafts a malicious FLI file containing manipulated header values designed to trigger the signed integer overflow during the dimensional calculation step.\nSecond, the attacker delivers this file to the victim via remote vectors such as email, file-sharing platforms, or malicious web downloads, relying on user interaction to initiate the parsing process.\nThird, the victim opens the malicious FLI file using GIMP, causing the vulnerable file-fli plugin to parse the file headers and execute the flawed memory allocation routine.\nFourth, the ensuing mismatch between the calculated buffer size and the actual data being written leads to out-of-bounds memory operations or immediate application termination.\nThe impact of this exploitation manifests as a complete denial of service via application crash, terminating the GIMP process and potentially resulting in the loss of unsaved user work.\nThe vulnerability requires no authentication or privilege requirements to execute, but strictly depends on local user interaction to open the malicious file, operating within the context of the user running the application."
}